受影响手机包括魅族,中国移动等国产手机。

5月12日开始有人在百度知道提问cmtwg,5月13日mx吧也有人在发贴。

我接到有问题的手机时间更早,大约就是五一之后。

出现问题的几个牌子的国产手机,似乎存在漏洞,对方可以利用4G网络,自动安插它们的软件到你的设备上。

com.wagd.qhsz的dump

com.wg.cmtwg的dump

自动安装时间点的日志

  **  ** I ActivityManager: Start proc :com.android.defcontainer/u0a20 for service com.android.defcontainer/.DefaultContainerService
D DefContainer: Copying /storage/emulated//.tm/882a3f6d5466518c3fb5290ada5f2a89 to base.apk
** ** I PackageManager.DexOptimizer: Running dexopt (dex2oat) on: /data/app/vmdl533505310.tmp/base.apk pkg=com.wg.cmtwg isa=arm64 vmSafeMode=false debuggable=false target-filter=interpret-only oatDir = /data/app/vmdl533505310.tmp/oat sharedLibraries=null
** ** V BackupManagerService: restoreAtInstall pkg=com.wg.cmtwg token=d restoreSet=
D DefContainer: Copying /storage/emulated//.tm/60d9d7e3febaf4ba2e3ce177747d76cf to base.apk
** ** I PackageManager.DexOptimizer: Running dexopt (dex2oat) on: /data/app/vmdl722489780.tmp/base.apk pkg=com.wagd.qhsz isa=arm64 vmSafeMode=false debuggable=false target-filter=interpret-only oatDir = /data/app/vmdl722489780.tmp/oat sharedLibraries=null
** ** I ActivityManager: Start proc :com.wg.cmtwg/u0a1** for activity com.wg.cmtwg/com.hikd.nvkhu.MainActivity
** ** I PackageManager.DexOptimizer: Running dexopt (dex2oat) on: /data/app/vmdl722489780.tmp/base.apk pkg=com.wagd.qhsz isa=arm64 vmSafeMode=false debuggable=false target-filter=interpret-only oatDir = /data/app/vmdl722489780.tmp/oat sharedLibraries=null
W System : ClassLoader referenced unknown path: /data/app/com.wg.cmtwg-/lib/arm64
W Settings: Setting development_settings_enabled has moved from android.provider.Settings.Secure to android.provider.Settings.Global.
W Settings: Setting adb_enabled has moved from android.provider.Settings.Secure to android.provider.Settings.Global.
W art : Class sdk.fkgh.hxx.x failed lock verification and will run slower.
W art : Common causes for lock verification issues are non-optimized dex code
W art : and incorrect proguard optimizations.
W art : Class sdk.fkgh.hxx.K failed lock verification and will run slower.
W art : Class sdk.fkgh.hxx.w failed lock verification and will run slower.
W Settings: Setting android_id has moved from android.provider.Settings.System to android.provider.Settings.Secure, returning read-only value.
W Settings: Setting android_id has moved from android.provider.Settings.System to android.provider.Settings.Secure, returning read-only value.
W art : Class sdk.fkgh.hxx.G failed lock verification and will run slower.
D MyService: onStartCommand:
W Settings: Setting development_settings_enabled has moved from android.provider.Settings.Secure to android.provider.Settings.Global.
W Settings: Setting adb_enabled has moved from android.provider.Settings.Secure to android.provider.Settings.Global.
I DpmTcmClient: RegisterTcmMonitor from: com.android.okhttp.TcmIdleTimerMonitor
** ** V BackupManagerService: restoreAtInstall pkg=com.wagd.qhsz token=e restoreSet=
** D Launcher.Model: mAllAppsList.addPackage com.wagd.qhsz
** ** I ActivityManager: START u0 {act=android.intent.action.MAIN flg=0x14800000 cmp=com.wagd.qhsz/com.wagd.gg.MainActivity} from uid on display
** ** I ActivityManager: Start proc :com.wagd.qhsz/u0a1** for activity com.wagd.qhsz/com.wagd.gg.MainActivity
W System : ClassLoader referenced unknown path: /data/app/com.wagd.qhsz-/lib/arm64
W System : ClassLoader referenced unknown path: /data/data/com.qihoo.shielder/files
D MyService: onStartCommand:
I DpmTcmClient: RegisterTcmMonitor from: com.android.okhttp.TcmIdleTimerMonitor
W ResourceType: ResTable_typeSpec entry count inconsistent: given , previously
I art : Compiler allocated 5MB to compile boolean com.qihoo360.mobilesafe.loaded.client.i.transact(int, android.os.Parcel, android.os.Parcel, int)
I System.out: true
I art : Do partial code cache collection, code=20KB, data=30KB
I art : After code cache collection, code=20KB, data=30KB
I art : Increasing code cache capacity to 128KB
** ** I ActivityManager: Process com.wagd.qhsz (pid ) has died
** ** D ActivityManager: cleanUpApplicationRecord --
** ** W ActivityManager: Scheduling restart of crashed service com.wagd.qhsz/com.wagd.gg.MyService in 1000ms
** ** I ActivityManager: Start proc :com.wagd.qhsz/u0a1** for service com.wagd.qhsz/com.wagd.gg.MyService
W System : ClassLoader referenced unknown path: /data/data/com.qihoo.shielder/files
W System : ClassLoader referenced unknown path: /data/app/com.wagd.qhsz-/lib/arm64
D MyService: onStartCommand:
I DpmTcmClient: RegisterTcmMonitor from: com.android.okhttp.TcmIdleTimerMonitor
W ResourceType: ResTable_typeSpec entry count inconsistent: given , previously
I art : Compiler allocated 5MB to compile boolean com.qihoo360.mobilesafe.loaded.client.i.transact(int, android.os.Parcel, android.os.Parcel, int)

上面日志发生了什么?

0. 日志清单之前1分钟内有DpmTcmClient的输出,可能是在下载安装包。

1. PackageManager被调用,启动了DefaultContainer,pid=20763

2. DefaultContainer启动一条线程tid=20780,先后将下载在/sdcard/.tm目录上的安装包

882a3f6d5466518c3fb5290ada5f2a89,60d9d7e3febaf4ba2e3ce177747d76cf

安装上,并且BackupManager恢复数据。

3. AM被调用,启动 com.wg.cmtwg,pid=20812

4. com.wg.cmtwg修改设置development_settings_enabled以及adb_enabled,然后开启http连接。

5. AM被调用,启动 com.wagd.qhsz,pid=21086

6. com.wagd.qhsz修改设置development_settings_enabled以及adb_enabled,然后开启http连接。

7. pid=21086,com.wagd.qhsz.Activity死亡

8. 1分钟后,AM重启com.wagd.qhsz/com.wagd.gg.MyService, pid=22085

9. com.wagd.qhsz/com.wagd.gg.MyService开启http连接。

这几款软件都是动态加载dex,只有发作后才能看到更多东西,和任务逻辑。

下面是我最初接到的手机,发作的情况。

软件会下载各路刷广告的sdk,加载后疯狂开线程刷广告,手机几乎超载运行发热感人激动,直至重启,然后反复无电累死。

发作的手机/sdcard目录下要有如下目录

/data/data/com.wagd.qhsz

/data/data/com.wg.cmtwg

下面列一些com.wagd.qhsz下载的dex反编译后找到的字串:

com.wagd.qhsz
"com.blankj.utilcode.util.PermissionUtils$PermissionActivity"
“http_stat12.guantouyouxi.com”
_235.do d.class "FULIYOUYICHENG"
.apk net.task.InitTask "WG20200430143295" "yy2042901"
.apk net.task.d "qtt://news_detail?from=And-juaiwan-19100503&id=1427705327", "", "com.jifen.qukan"
.apk net.task.e "com.android.browser" "com.eg.android.AlipayGphone" "mBasePackageName"
*.dex com.api.a class: "http://sdktoapi.free-eyepro.com" "ad.vv.sdk"
*.dex com.lo.ca.realtimeweb.kernel.web.ai class: "wzb api inject js next_script_order="
*.dex com.lo.ca.realtimeweb.kernel.web.ak class: "qh api evaluateJavascript_qh---ua="
*.dex h.e class: "--------------------canRunBeiYeSDK-start-----------ADID==>"
*.dex h.i class: "beiyeAPI_" "com.yjl.sdk" "com.yjl.sdk.mango" "com.yjl.sdk.web" "com.yjl.sdk.xinyun" "com.yjl.sdk.baidu" "com.ext.sdk"

大概的工作原理,就是后台webview刷广告api,注入js刷数据刷流量。sdk都注名为anshuan。

下载到的dex文件都重命名后缀.do,编译后oat文件都重命名后缀.dex,如果不会用xxd区分文件格式的话,就在反编译时受阻。

所以期间正好写了一个gui4smali的demo,因为它们实在下载了太多odex。

cmtwg,qhsz,nvkhu在安装自动获取到了所有的权限,包括访问/sdcard,自动加入inet用户组,隐私风险最高级。它们似乎拥有除root和SEandroid外一切有用的权限。可以让删除它们后的手机,后台自动去下载并安装(或者说直接通过4G网络让你的手机下载并安装),安装同时授权一切。设备惹上后扛扛是一块肉鸡,而且隐私风险最高。

最新文章

  1. 用JS控制video暂停再播放
  2. 关于OnEraseBkgnd和OnPaint的转载
  3. 使用BPEL创建Web服务组合
  4. Ubuntu 配置AP总结
  5. Hadoop: The Definitive Guide (3rd Edition)
  6. vm虚拟机上安装apache+php+ftp+mysql
  7. bootstrap兼容IE8 解决办法
  8. recover all files with git
  9. 关于SSDT
  10. mysql在ubuntu中的操作笔记(详)
  11. servlet操作本地文件汇总: 判断文件是否存在;文件重命名;文件复制; 获取文件属性信息,转成Json对象; 获取指定类型的文件; 查找替换.txt中的文本
  12. Beta阶段冲刺二
  13. Linux查看特定端口是否被占用并kill掉相关进程
  14. lua元表学习
  15. matlab画图标题自定义字体大小
  16. 第12月第1天 MASConstraintMaker crash
  17. java 总结代码块
  18. C++编写简单的Service和Client
  19. vlc源码分析(七) 调试学习HLS协议
  20. EM算法的思考

热门文章

  1. bootstrop设置背景图片自适应屏幕
  2. [Linux] 检查是否已有进程在运行
  3. Copy ArrayList的四种方式
  4. java中Runnable和Callable的区别
  5. Spring5参考指南:基于Schema的AOP
  6. vue2.x学习笔记(二十五)
  7. CF1324 --- Maximum White Subtree
  8. 你所不知道的Python | 字符串连接的秘密
  9. cobbler的网页操作
  10. 使用mvp+rxjava+retrofit加载数据